IT General Controls and Control Frameworks
Domain 2 tests whether you understand the controls that make the rest of the audit trustworthy. Application controls and business controls are only as reliable as the IT general controls underneath them, so the exam asks you to classify controls, judge design against operating effectiveness, and evaluate third-party assurance reports.
The ITGC families
- Access to programs and data: provisioning, authentication, privileged access, periodic review, termination.
- Program changes: authorisation, testing, segregation of duties, emergency change review.
- Program development: stage gates, environment segregation, data migration, go-live approval.
- Computer operations: scheduling, monitoring, backup and restore, incident handling.
Classifying a control
- Preventive, detective or corrective.
- Manual, automated, or IT-dependent manual (an automated report a person reviews).
- Key versus non-key; and always separate design effectiveness from operating effectiveness.
- A compensating control counts only if it addresses the same risk, at acceptable precision, and is itself tested.
Frameworks are maps, not evidence
- COBIT 2019 for governance and management objectives; ISO/IEC 27001:2022 Annex A (93 controls across organisational, people, physical and technological themes) for an ISMS; NIST CSF 2.0 functions of Govern, Identify, Protect, Detect, Respond, Recover; CIS Controls for prioritisation.
- Mapping a control to three frameworks produces no assurance. Testing it does.
Reading SOC reports
- SOC 1 addresses controls relevant to financial reporting: Type 1 covers description fairness and design suitability at a point in time; Type 2 adds operating effectiveness over a period.
- SOC 2 covers trust services criteria (security, availability, processing integrity, confidentiality, privacy) and is not automatically ICFR evidence.
- Carve-out reports exclude controls performed by the user entity; inclusive reports bring in subservice organisations. Complementary user entity controls must be mapped to what your client actually does.
Worked example
The audit period is January to December. The service organisation supplies a SOC 1 Type 2 covering January to September. The three-month gap cannot be closed by the report, so the auditor obtains a bridge letter covering October to December and evaluates whether it addresses the relevant controls, or performs alternative procedures at the user entity. Relying on the report as if it covered the full period is the error the question is testing.
Traps
- Using a Type 1 report as period coverage.
- Ignoring complementary user entity controls.
- Reading an unqualified SOC 2 opinion as no exceptions in the detail.
- Assuming a framework certificate replaces control testing.